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REMARKS 

Reconsideration of tliis application is respectfully requested in view of the 
foregoing amendment and the following remarks. 

Claims 1-4 and 6-8 are currently pending in the application and subject to 
examination. 

I. Specification 

The Office Action mailed October 29, 2007 objects to the specification. The 
specification has been amended as suggested by the Examiner. If any further 
amendment is required to overcome this objection, the Examiner is requested to contact 
the representative below. 

II. 35 U.S.C. § 103 

Claims 1-4 and 6-8 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over U.S. Patent No. 6,757,830 to Tarbotten et al. ("Tarbotten") in view of U.S. Pub. No. 
2004/0054498 to Shipp ("Shipp"). The Applicant hereby traverses the rejection as 
follows. 

A. Claims 1-4 

Applicant's invention as set forth in claim 1 is directed to a method of preventing 
the infection of a computer network by a computer virus, where that virus can spread by 
e-mail traffic, the method including in the event that a new virus is detected by a 
provider of the anti-virus application, sending a notification of this event from the 
provider to the anti-virus application, at the anti-virus application, responding to said 
notification by discontinuing normal handling of e-mails, wherein discontinuing 
normal handling of e-mails includes falling to deliver incoming e-mails or their 
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attachments to their recipients within the network and causing these e-mails or 
attachments to be re-directed to a buffer for safe storage; subsequently generating 
a signature for the virus at the anti-virus application provider and providing that 
signature to the application at the gateway; at the gateway, after receiving the signature, 
using the application to scan the previously buffered e-mails or attachments for the 
virus, after scanning the buffered e-mails, delivering e-mails or attachments which are 
virus free to their recipients; and causing the normal handling of e-mails at the e- 
mail gateway to be resumed. 

Although Tarbotten notes that it takes time to react to and generate counter- 
measures against a new virus, Tarbotten responds to this problem by delaying the 
delivery of e-mails at all times. The length of the delay is determined by the risl< 
characteristics of the e-mails not based upon a notification from a provider of anti-virus 
application. (See column 6, lines 59-67). This delay is intended to provide an 
opportunity for an anti-virus server to provide updates of virus signatures to the gateway 
and increase the chances of identifying infected e-mails. Thus, Tarbotten teaches that 
e-mails are buffered at the gateway to allow virus alerts to catch up with e-mail delivery. 

The invention recited in claim 1 only delays the delivery of e-mails when a new 
virus has been identified, i.e. at a time of high risk. Then, delivery is delayed until a 
virus signature is provided to ensure that no infected e-mails are delivered. The 
introduction of the delay is triggered by the provider of the anti-virus application sending 
a notification to the anti-virus notification, for example e-mail gateway, as recited in 
claim 1. 



LDR/214453.1 



4 



Application No. 10/501,336 
Attorney Docket No. 108347-00031 

Shipp fails to cure the deficiency in Tarbotten. Ship teaches a method of 
detecting the spread of a previously unknown virus by monitoring patterns of e-mail 
traffic. Once a suspected virus is detected, the characteristics of infected e-mails are 
provided to the e-mail gateways. Thus, Shipp discloses the provision of conventional 
anti-virus updates rather than advance notification as provided in claim 1. 

Thus, Shipp fails to cure the deficiency in Tarbotten, and all e-mails will continue 
to be delayed in the normal handling of e-mails. Shipp merely provides an allegedly 
improved virus "fingerprint." 

The Office Action notes that Tarbotten does not disclose or suggest discontinuing 
the normal handling of e-mails when notified of a new virus and subsequently resuming 
the normal handling of e-mails when appropriate countermeasures have been taken, 
but asserts that this would have been obvious. 

As Tarbotten functions by delaying all e-mail for a length of time depending on 
the individual characteristics of each e-mail, the Office Action's proposed modification 
that "wherein discontinuing normal handling of e-mails includes failing to deliver 
incoming e-mails or their attachments and causing these e-mails to be re-directed to a 
buffer for safe storage" as recited in claim 1 would improperly change the principle of 
operation in Tarbotten. See MPEP § 2143.01. 

For at least this combination of reasons, the Applicant submits that claim 1 is 
allowable over the cited art. As claim 1 is allowable, the Applicant submits that claims 
2-4, which depend from allowable claim 1 , are therefore also allowable for at least the 
above noted reasons and for the additional subject matter recited therein. 
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B. Claims 6 and 7 

The Applicant submits that Tarbotten and Shipp, whether taken alone or in 
combination (not admitted), do not disclose a computer system or a computer software 
storage medium having stored thereon an antivirus application arranged to receive a 
notification from the provider . . . which notification causes the application to prevent 
delivery of e-mails or attachments received at the gateway and to divert these e-mails to 
a buffer and arranged to subsequently receive a second notification from the provider 
which notification causes the application to cease preventing delivery of newly received 
e-mails, as recited in claims 6 and 7. 

The inventions recited in claims 6 and 7 involve a first notification sent by the 
provider that diverts the flow of e-mail to a buffer and a second notification that causes 
the gateway to cease preventing delivery of newly received e-mails. 

As discussed above, Tarbotten always delays newly received e-mails and Shipp 
fails to cure the deficiency in Tarbotten. Thus, for reasons similar to those discussed 
above, the Applicant submits that claim 1 is allowable over the cited art. 

C. Claim 8 

Applicant's invention as set forth in claim 8 is directed to a method of preventing 
the infection of a computer network by a computer virus, the method comprising in the 
event that a new virus is detected by the provider of the anti-virus application, 
calculating a checksum for the file carrying the virus or a relevant part of that file, and 
sending a notification containing the checksum from the provider to the anti-virus 
application, and at the anti-virus application, using the checksum to screen e-mails 
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and/or their attachments for the virus until such time as a signature for the virus is 
received by the e-mail gateway from the application provider. 

Tarbotten teaches an e-mail message including a header portion including a 
checksum value for the e-mail message as a whole as a countermeasure against 
attempts to falsely insert data indicating that a minimum delay period has already been 
applied to the message. 

Tarbotten does not disclose or suggest using a checksum to screen e-mails for a 
virus, as recited in claim 8. Additionally, Tarbotten does not teach a checksum provided 
by the anti-virus application provider as part of a new virus notification, as recited in 
claim 8. Furthermore, Tarbotten does not disclose or suggest replacing the use of the 
checksum from the anti-virus application provider until such time as a signature for the 
virus is received. 

As discussed above, Shipp fails to cure the deficiency in Tarbotten. 

For at least this combination of reasons, the Applicant submits that claim 8 is 
allowable over the cited art. 

CONCLUSION 

For all of the above reasons, it is respectfully submitted that the claims now 
pending patentability distinguish the present invention from the cited references. 
Accordingly, reconsideration and withdrawal of the outstanding rejections and an 
issuance of a Notice of Allowance are earnestly solicited. 

Should the Examiner determine that any further action is necessary to place 
this application into condition for allowance, the Examiner is encouraged to 
telephone the undersigned representative at the number listed below. 
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In the event this paper is not considered to be timely filed, the Applicants hereby 
petition for an appropriate extension of time. The fee for this extension may be charged 
to our Deposit Account No. 01-2300. The Commissioner is hereby authorized to charge 
any fee deficiency or credit any overpayment associated with this communication to 
Deposit Account No. 01-2300 with reference to Attorney Docket No. 108347-00031 . 



Customer No. 004372 

1050 Connecticut Ave., N.W. 
Suite 400 

Washington, D.C. 20036-5339 
Telephone No. (202) 715-8492 
Facsimile No. (202) 857-6395 



Respectfully submitted, 



Arent Fox LLP 



Sheree T. Rowe 
Attorney for Applicants 
Registration No. 59,068 
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